📚 Fingerprint and Facial Recognition Data in Schools: What Protection Rules Must Be Followed? | 学校采集学生指纹与人脸信息 需遵守哪些保护规定
Fingerprint scanners at the canteen till, facial recognition at the school gate, biometric library loans: schools are adopting identification technology far faster than most parents realise. Because biometric data can identify a person permanently and cannot be reissued like a password, the law treats it as a high-risk category. This article sets out the rules that schools, and the companies selling them systems, must follow.
食堂刷卡机上的指纹识别、校门口的人脸闸机、图书馆的生物识别借阅：学校采用身份识别技术的速度，远快于大多数家长的认知。由于生物识别信息能够永久识别个人，且无法像密码那样"重新签发"，法律将其列为高风险类别。本文系统梳理学校（以及向学校销售系统的企业）必须遵守的保护规定。
1. Why Biometric Data Is a Special Category | 为什么生物识别信息属于"特殊类别"
Biometric data means any personal data resulting from specific technical processing of physical, physiological or behavioural characteristics, such as fingerprints, iris patterns, voiceprints and facial geometry. It stops being ordinary data and becomes special category data when it is processed for the purpose of uniquely identifying a person.
生物识别信息是指对自然人的身体、生理或行为特征（如指纹、虹膜、声纹、面部几何特征）进行特定技术处理所得到的个人数据。当处理目的是"唯一识别特定自然人"时，它就升级为特殊类别数据，而非普通个人数据。
Three features make it uniquely dangerous in a school context. First, it is permanent: a leaked password can be changed, a leaked fingerprint cannot. Second, it is involuntary: a student cannot consent meaningfully to being tracked simply by walking through a gate. Third, it is increasingly used as an authentication key, so a breach may enable identity fraud years later.
在学校场景中，它有三个独特风险。第一，永久性：密码泄露可以更换，指纹泄露无法更换。第二，非自愿性：学生只要走过一道闸机，就可能被动地被识别，无从"参与决定"。第三，它越来越多地充当身份认证密钥，一次泄露可能在多年后引发身份冒用。
Children are also treated as a vulnerable group. Regulators accept that children may be less able to understand long-term consequences, and that facial recognition algorithms are typically less accurate on growing faces, which raises both privacy and fairness concerns.
未成年人同样被视为弱势群体。监管机构普遍承认：儿童更难理解长期后果；同时人脸识别算法对处于生长发育期的儿童面部准确率通常更低，这同时带来了隐私与公平性问题。
2. Which Laws Actually Apply | 究竟适用哪些法律规定
There is no single global rule. A school's obligations depend on where it operates and where its students live. In the United Kingdom and the European Union, the framework is the UK GDPR or EU GDPR read with the Data Protection Act 2018, supplemented in England and Wales by the Protection of Freedoms Act 2012 on biometric information in schools.
并不存在统一的全球规则。学校义务取决于其所在法域以及学生所在地。在英国与欧盟，框架是 UK GDPR 或 EU GDPR，配合《2018 年数据保护法》；在英格兰和威尔士，另有《2012 年保护自由法》专门规范学校处理生物识别信息。
In mainland China, the key instruments are the Personal Information Protection Law (PIPL), the Law on the Protection of Minors, the Regulations on the Protection of Minors in Cyberspace, and the Measures for the Security Management of the Application of Facial Recognition Technology, which took effect on 1 June 2025 and specifically addresses facial data of minors.
在中国内地，主要依据包括《个人信息保护法》《未成年人保护法》《未成年人网络保护条例》，以及自 2025 年 6 月 1 日起施行的《人脸识别技术应用安全管理办法》，后者专门规范未成年人的人脸信息处理。
In the United States, FERPA protects education records, COPPA governs online collection from children under 13, and state biometric privacy statutes such as the Illinois Biometric Information Privacy Act impose written-consent and retention duties, with a private right of action for violations.
在美国，《家庭教育权利与隐私法》（FERPA）保护教育记录，《儿童在线隐私保护法》（COPPA）规范向 13 岁以下儿童的在线收集，而伊利诺伊州《生物识别信息隐私法》等州法规定了书面同意与留存期限义务，并允许个人直接起诉。
| Jurisdiction | 法域 | Key instrument | 核心依据 | Consent gate | 同意门槛 |
| UK / EU | UK GDPR, DPA 2018, Protection of Freedoms Act 2012 | 英国 GDPR、2018 数据保护法、2012 保护自由法 | Explicit consent or a narrow statutory condition; at least one parent's written consent for school biometrics | 明示同意或严格限定的法定情形；学校生物识别须取得至少一位家长书面同意 |
| China | 中国 | PIPL, Minors Protection Law, Facial Recognition Measures | 个人信息保护法、未成年人保护法、人脸识别办法 | Separate consent; guardian consent plus separate consent for under-14s | 单独同意；不满 14 周岁须监护人同意并单独同意 |
| USA | 美国 | FERPA, COPPA, state biometric statutes (e.g. BIPA) | FERPA、COPPA、各州生物识别法（如 BIPA） | Written informed consent under biometric statutes; parental consent under COPPA | 生物识别法要求书面知情同意；COPPA 要求家长同意 |
3. Lawful Basis and Explicit Consent | 合法性基础与明示同意
Under Article 9 of the GDPR, processing special category data is prohibited unless one of ten narrow conditions applies. For a school, the realistic options are explicit consent, or the substantial public interest condition under Schedule 1 of the DPA 2018 where a specific legal obligation or safeguarding purpose exists. Vague "admin convenience" is not a condition.
根据 GDPR 第 9 条，处理特殊类别数据原则上被禁止，除非符合十项严格例外之一。对学校而言，现实可行的路径是"明示同意"，或在存在具体法律义务或保护目的时援引《2018 年数据保护法》附表 1 的"重大公共利益"情形。以"管理方便"为由并不成立。
Under Chinese law, biometric information is sensitive personal information, which requires a specific and reasonable purpose, sufficient necessity, strict protective measures, and separate consent. "Separate consent" means a distinct, unbundled opt-in: it cannot be buried in a general enrolment form or an acceptable-use policy.
在中国法下，生物识别信息属于敏感个人信息，须具备特定、合理的目的，充分的必要性，严格的保护措施，并取得"单独同意"。单独同意意味着独立、不可捆绑的明确同意：它不能藏在入学登记表或一般校规里。
Valid consent must be freely given, specific, informed and unambiguous, and must be as easy to withdraw as to give. If a system automatically enrols students and requires an opt-out email to a busy administrator, the consent is not free.
有效同意必须自愿、具体、知情、明确，并且撤回与给予同样便捷。如果系统默认自动录入学生信息，而退出需要给繁忙的行政老师发邮件申请，那么这种"同意"并不自由。
4. Children's Consent and Age Thresholds | 未成年人同意与年龄门槛
The GDPR sets a digital consent age between 13 and 16 depending on member state, with the UK choosing 13 for information society services. However, biometric identification in a school is not a marketing cookie: regulators expect parental involvement and a much higher threshold of justification regardless of the pupil's age.
GDPR 将数字同意年龄设定为 13 至 16 岁（各成员国自定），英国对信息社会服务采用 13 岁。但学校中的生物识别并非营销 Cookie：监管机构期望家长参与，且无论学生年龄大小，都要求更高的正当性门槛。
Chinese law is explicit. Processing the personal information of a minor under 14 requires the guardian's consent, and for sensitive information such as facial data both guardian consent and separate consent are required. The 2025 Facial Recognition Measures reinforce this for schools and other venues.
中国法规定得更为明确：处理不满 14 周岁未成年人的个人信息，应当取得其父母或者其他监护人的同意；对包括人脸信息在内的敏感个人信息，还需同时取得监护人同意与单独同意。2025 年的人脸识别办法对学校等场所进一步强化了这一要求。
In practice this means age assurance, guardian verification, and a simple language explanation that a 10-year-old can genuinely understand. A signed form that no parent reads is not informed consent.
实践中这意味着：年龄核验、监护人身份核验，以及用 10 岁孩子能真正理解的平实语言进行说明。一份没有任何家长真正阅读的签字表格，并不构成知情同意。
5. Assessment Before Deployment | 部署前的强制评估
A data protection impact assessment is mandatory where processing is likely to result in a high risk to rights and freedoms, and biometric processing on a large scale, or systematic monitoring, is a classic trigger. In China the equivalent duty is the personal information protection impact assessment required for sensitive information processing.
当处理活动可能对个人权利与自由带来高风险时，数据保护影响评估即为强制，而大规模生物识别处理或系统性监控正是典型的触发情形。在中国，对应的义务是处理敏感个人信息前必须开展的"个人信息保护影响评估"。
The assessment must be completed before the system goes live, not retrofitted afterwards. It should record the purpose, the necessity argument, the alternatives rejected, the risk of function creep, the accuracy and bias testing results, the retention period, and the residual risk after mitigation.
评估必须在系统上线之前完成，而不能事后补做。评估应记录：处理目的、必要性论证、被否决的替代方案、功能蔓延风险、准确率与偏见测试结果、留存期限，以及采取缓解措施后的残余风险。
Risk 风险 = Likelihood 发生可能性 × Impact 影响程度 × Scale 涉及人数
Schools are also expected to consult their data protection officer and, in high residual risk cases, the supervisory authority before proceeding. Skipping this step is one of the most common findings in enforcement actions.
学校还应咨询数据保护官，在残余风险仍然很高的情况下，须在处理前咨询监管机构。省略这一步是执法案例中最常见的违规点之一。
6. Necessity, Proportionality and Alternatives | 必要性、比例原则与替代方案
The decisive question is not "does the technology work?" but "is there a less intrusive way to achieve the same goal?" A fingerprint for canteen payment is normally replaceable by a card, a PIN or a QR code. Facial recognition for registration is replaceable by a card reader or a teacher's roll call.
关键问题不是"这项技术能不能用"，而是"是否存在侵入性更低、效果相同的替代方案"。食堂支付的指纹通常可以用实体卡、密码或二维码替代；人脸考勤可以用刷卡或教师点名替代。
The Protection of Freedoms Act 2012 requires schools in England and Wales to offer a reasonable alternative to biometric systems and to stop processing if a parent objects in writing. Where an alternative would be genuinely disruptive, the school still bears the burden of proving it.
《2012 年保护自由法》要求英格兰和威尔士的学校为生物识别系统提供合理的替代方案，并在家长书面反对时停止处理。即使替代方案确实会造成不便，举证责任仍在学校一方。
Chinese rules go further by requiring that a non-biometric verification method be available whenever other methods can achieve the same purpose, and prohibiting coercion such as conditioning entry, attendance or canteen use on biometric enrolment.
中国规定更进一步：当其他方式能够实现相同目的时，应当提供非生物识别的验证方式；禁止以"拒绝录入就不准入校、不计考勤、不能就餐"等方式变相强迫。
7. Transparency and Genuine Choice | 告知义务与真正的自愿
Students and guardians must be told, in clear and plain language, who is collecting the data, why, exactly what is captured, how long it is kept, who else receives it, and how to withdraw. Privacy information for children should be short, visual and readable.
必须用清晰平实的语言告知学生与监护人：由谁收集、目的为何、具体采集什么、保存多久、还会提供给谁、以及如何撤回。面向儿童的隐私说明应简短、直观、易读。
Transparency also bans bundling. A school cannot make biometric enrolment a condition of receiving education, sitting examinations, borrowing books or entering the building. Consent obtained under those conditions is invalid, and in several jurisdictions the practice is separately unlawful.
透明原则还禁止"捆绑"。学校不得把生物识别录入作为入学、考试、借书或进入校园的前提条件。在此类条件下取得的同意无效；在若干法域，这种做法本身即属违法。
Notices should also explain automated decision-making. If a system flags a student as "absent" or "suspicious" without human review, individuals have the right to be informed and, in many cases, to obtain human intervention.
告知还应说明自动化决策。若系统在无人工复核的情况下把某学生标记为"缺勤"或"可疑"，个人有权知情，并在多数情形下有权要求人工介入。
8. Security, Templates and Retention | 安全措施、模板与留存期限
The gold standard is to store irreversible mathematical templates rather than raw fingerprints or photographs, and to keep them on the local device rather than in a central or cloud database. Raw biometric samples should be deleted immediately after template generation.
最佳实践是存储不可逆的数学模板，而非原始指纹图像或照片，并把模板保存在本地设备中，而不是集中式或云端数据库。原始生物特征样本应在生成模板后立即删除。
Technical controls include encryption in transit and at rest, strict role-based access, multi-factor authentication for administrators, logging of every query, penetration testing, and a documented deletion schedule. Chinese rules require facial information to be stored within the recognition device and not transmitted over the internet except with separate consent or a legal basis.
技术措施包括传输与存储加密、严格的角色权限、管理员多重身份验证、每一次查询的日志记录、渗透测试，以及有文档化的删除计划。中国规定要求人脸信息存储于人脸识别设备内，除取得单独同意或法律另有规定外，不得通过互联网对外传输。
Retention must be tied to a defined purpose. "Indefinitely, in case it is useful" fails the storage limitation principle. A common approach is to delete the template on the student's withdrawal or graduation, and to refresh consent annually.
留存期限必须与确定目的绑定。"无限期保存以备不时之需"违反存储限制原则。常见做法是：学生转学或毕业时删除模板，并每年重新确认同意。
9. Vendors, Processors and Cross-Border Transfers | 供应商、受托处理与跨境传输
Most schools do not build these systems; they buy them. The school remains the controller and is accountable for what the vendor does. A written data processing agreement must specify the processing purpose, security measures, sub-processors, breach notification timelines, audit rights and deletion on termination.
多数学校并非自建系统，而是采购系统。学校仍是"控制者"，须对供应商的行为负责。书面数据处理协议必须明确：处理目的、安全措施、次级处理者、泄露通知时限、审计权，以及合同终止时的删除义务。
Due diligence should ask where the data is stored, whether it is transferred abroad, whether templates are used to train or improve models, and whether any data is sold or shared with advertisers. Selling biometric data, or using it to train third-party models without specific consent, is prohibited or heavily restricted in most regimes.
尽职调查应追问：数据存放在哪里、是否跨境传输、模板是否被用于训练或优化模型、数据是否被出售或与广告商共享。在多数法域，出售生物识别数据或在无特定同意的情况下用于训练第三方模型，均被禁止或严格限制。
Cross-border transfers face extra conditions. Under PIPL, transferring sensitive personal information abroad generally requires separate consent plus a mechanism such as a security assessment, standard contract filing or certification. Under the GDPR, transfers need an adequacy decision or appropriate safeguards.
跨境传输面临额外条件。依《个人信息保护法》，向境外提供敏感个人信息通常须取得单独同意，并同时满足安全评估、标准合同备案或认证等机制之一。依 GDPR，传输需具备充分性认定或适当保障措施。
10. Individual Rights and Redress | 个人权利与救济途径
Students and guardians hold enforceable rights: to be informed, to access a copy of the data, to rectify errors, to erase data where there is no longer a lawful basis, to object to processing, and to withdraw consent at any time without detriment.
学生与监护人享有可执行的权利：知情权、查阅复制权、更正权、在缺乏合法基础时删除权、反对处理权，以及随时撤回同意且不受不利对待的权利。
Withdrawal must be operationally real. If a student withdraws consent, the school must disable the biometric pathway and switch to the alternative within a reasonable period, not merely record the request. Refusing to provide the alternative after withdrawal is a separate violation.
撤回必须在操作层面真正落地。学生撤回同意后，学校应在合理期限内停用生物识别通道并切换到替代方案，而不能只是登记一下申请。撤回后拒绝提供替代方案，本身构成另一项违法行为。
Redress routes differ by jurisdiction: complaints to the Information Commissioner's Office in the UK, complaints to cyberspace or education authorities in China, and in some US states a direct private right of action with statutory damages per violation.
救济途径因法域而异：在英国可向信息专员办公室投诉；在中国可向网信、教育等主管部门投诉举报；在美国部分州，个人可直接提起民事诉讼并主张法定赔偿。
11. Breaches, Accountability and Governance | 泄露响应、问责与治理
A biometric breach is not a routine IT incident. Where it poses a risk to rights and freedoms, controllers must notify the supervisory authority within 72 hours and inform affected individuals without undue delay, and must record the incident regardless.
生物识别信息泄露不是普通的 IT 事故。当它对个人权利与自由构成风险时，控制者须在 72 小时内通知监管机构，并及时告知受影响的个人；同时无论是否通知，都必须记录该事件。
Accountability is ongoing, not a one-off form. Schools should appoint a responsible lead, train staff on handling biometric queries and refusals, review access logs, retest accuracy, and re-run the impact assessment whenever the vendor, the purpose or the scope changes.
问责是持续义务，而非一次性表格。学校应指定负责人，培训教职员工如何处理生物识别相关询问与拒绝情形，定期审查访问日志，复测准确率，并在供应商、目的或范围变化时重新开展影响评估。
Finally, schools should remember that the safest biometric system is often the one that is never deployed. Where a card, a PIN or a teacher's list achieves the same educational outcome, choosing biometrics transfers permanent risk to children for marginal administrative gain.
最后，学校应牢记：最安全的生物识别系统，往往是没有部署的那一个。如果一张卡、一个密码或教师手中的名册就能达到同样的教育管理效果，那么选择生物识别，等于用儿童的永久性风险去换取微小的管理便利。
12. Quick Compliance Checklist for School Leaders | 学校管理者合规速查清单
The following checklist summarises the core obligations. It is written for governance use, so each item should be answerable with documentary evidence rather than verbal assurance.
下表汇总核心义务，按治理用途设计：每一项都应当能用书面材料证明，而不只是口头保证。
| Step | 步骤 | Action | 应做事项 | Evidence | 证明材料 |
| 1 | Confirm necessity and reject less intrusive alternatives | 论证必要性，排除侵入性更低的替代方案 | 广告 / Sponsored 华为平板电脑MatePad Mini悦读版8.8英寸保护套内胆包皮质平板电脑袋轻薄皮套防泼水收纳袋手拿配件轻便减震 券减¥3.0¥36原价 ¥39 券后价 · 以淘宝页面为准 学习备考用品 · 正版现货 · 学习备考通用 查看详情 / View on Taobao广告 / Sponsored 微软Surface Laptop Ultra 15英寸电脑支架笔记本散热托支撑架子增高悬空可调节升降铝合金配件可折叠便… 券减¥3.0¥56原价 ¥59 券后价 · 以淘宝页面为准 学习备考用品 · 正版现货 · 学习备考通用 查看详情 / View on Taobao更多咨询请联系16621398022（同微信） 备考资讯每日更新，关注不错过 考纲变化 · 科目分析 · 学习方法  在微信里长按二维码识别关注 或截图后用「扫一扫 → 相册」选择本图 公众号：tutorhao |
